Kerberoasting — CraftedSignal Threat Feed

PowerShell Kerberos Ticket Request via KerberosRequestorSecurityToken

hello@craftedsignal.io — Tue, 09 Jan 2024 18:45:00 +0000

This detection identifies PowerShell scripts leveraging the KerberosRequestorSecurityToken class to request Kerberos service tickets. Attackers often use this technique to perform Kerberoasting, where they obtain service tickets for various service principal names (SPNs) and crack the associated service account passwords offline. This activity can be indicative of an attacker attempting to gain unauthorized access to sensitive resources within the network. The rule is designed to trigger on potentially malicious uses of KerberosRequestorSecurityToken while attempting to filter out legitimate uses, such as those within Sentinel breakpoints or authorized Kerberos diagnostic scripts. Defenders should investigate any instances of this activity to determine whether it represents a genuine threat.

Attack Chain

Initial Access: An attacker gains initial access to a Windows system, potentially through phishing, compromised credentials, or exploiting a vulnerability.
Execution: The attacker executes a PowerShell script, either interactively or via a scheduled task or other means of remote execution.
Obfuscation (Optional): The PowerShell script may be obfuscated to evade detection, using techniques such as Base64 encoding or string manipulation.
Ticket Request: The script uses the KerberosRequestorSecurityToken class to request Kerberos service tickets for one or more SPNs.
Data Collection: The script collects the requested service tickets and potentially saves them to a file or transmits them over the network.
Credential Access: The attacker extracts the Kerberos hashes from the collected tickets.
Offline Cracking: The attacker uses tools like John the Ripper or Hashcat to crack the service account passwords offline.
Privilege Escalation/Lateral Movement: Upon successfully cracking the passwords, the attacker uses the compromised credentials to escalate privileges or move laterally within the network.

Impact

Successful Kerberoasting attacks can lead to the compromise of service accounts, potentially granting attackers unauthorized access to critical systems and sensitive data. The impact can range from data breaches and financial losses to complete system compromise and disruption of business operations. The rule’s medium severity reflects the potential for significant impact if the attack succeeds.

Recommendation

Enable PowerShell Script Block Logging to capture the PowerShell script content necessary for detection, and ensure the logs are being ingested into your SIEM. Reference: Setup instructions.
Deploy the Sigma rule “PowerShell Kerberos Ticket Request” to your SIEM to detect suspicious use of KerberosRequestorSecurityToken in PowerShell scripts.
Investigate any alerts triggered by the Sigma rule, focusing on reconstructing the full script content, identifying the targeted SPNs, and analyzing the process execution context to determine if the activity is malicious.
Review Windows Security event logs on domain controllers for event ID 4769, filtering for the TargetUserName associated with the alerting user to identify related Kerberos ticket requests.

Kerberos Traffic from Unusual Process

hello@craftedsignal.io — Wed, 03 Jan 2024 14:00:00 +0000

This detection identifies unusual processes initiating network connections to the standard Kerberos port (88) on Windows systems. Typically, the lsass.exe process handles Kerberos traffic on domain-joined hosts. The rule aims to detect processes other than lsass.exe communicating with the Kerberos port, which could indicate malicious activity such as Kerberoasting (T1558.003) or Pass-the-Ticket (T1550.003). The detection is designed to work with data from Elastic Defend and SentinelOne Cloud Funnel. This can help security teams identify potential credential access attempts and lateral movement within the network.

Attack Chain

An attacker compromises a user account or system within the domain.
The attacker executes a malicious binary or script (e.g., PowerShell) on the compromised system.
The malicious process attempts to request Kerberos service tickets (TGS) for various services within the domain. This is done by connecting to the Kerberos port (88) on a domain controller.
The attacker uses tools like Rubeus or Kerberoast.ps1 to enumerate and request TGS tickets.
The unusual process (not lsass.exe) sends Kerberos traffic to the domain controller.
The attacker extracts the Kerberos tickets from memory or network traffic.
The attacker cracks the offline TGS tickets to obtain service account passwords (Kerberoasting).
The attacker uses the compromised service account credentials to move laterally within the network or access sensitive data.

Impact

A successful Kerberoasting or Pass-the-Ticket attack can lead to unauthorized access to sensitive resources and lateral movement within the network. Attackers can compromise service accounts with elevated privileges, potentially leading to domain-wide compromise. Detection of this behavior can prevent attackers from gaining access to critical assets. While the exact number of victims and sectors targeted are unknown, this technique is widely used by various threat actors in targeted attacks.

Recommendation

Deploy the “Kerberos Traffic from Unusual Process” Sigma rule to your SIEM and tune for your environment. Enable network connection logging to capture the necessary traffic.
Investigate any alerts triggered by the Sigma rule, focusing on the process execution chain and potential malicious binaries.
Review event ID 4769 for suspicious ticket requests as mentioned in the rule’s documentation.
Examine host services for suspicious entries as outlined in the original Elastic detection rule using Osquery.
Monitor for processes connecting to port 88, filtering out legitimate Kerberos clients like lsass.exe, using the “Detect Kerberos Traffic from Non-Standard Process” Sigma rule.
Investigate processes identified by the rule and compare them to the list of legitimate processes to identify unauthorized connections to the Kerberos port.

User Account ServicePrincipalName Attribute Modified

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This detection rule identifies modifications to the servicePrincipalName (SPN) attribute of user accounts within Active Directory. Attackers can exploit write privileges over a user account to configure SPNs, enabling them to perform Kerberoasting attacks. While administrators may configure SPNs legitimately, this exposes the account to potential abuse. The risk arises because user-defined passwords are often less complex than machine account passwords, making them vulnerable to cracking. The rule focuses on identifying when a user account is at increased risk due to SPN modifications, indicating potential Kerberoasting vulnerabilities. The original Elastic rule was published on 2022-02-22 and last updated on 2026-05-04.

Attack Chain

An attacker gains initial access to a system with a user account that possesses write privileges to other user accounts within Active Directory.
The attacker identifies a target user account for which they want to perform Kerberoasting.
The attacker modifies the servicePrincipalName attribute of the target user account using tools like SetSPN.exe or PowerShell.
A Kerberos client requests a ticket-granting service (TGS) ticket for the modified SPN.
The domain controller encrypts the TGS ticket with the secret key (NTLM hash) of the target user account.
The attacker extracts the encrypted TGS ticket from network traffic or the Kerberos client cache.
The attacker performs offline password cracking on the extracted TGS ticket to recover the plaintext password of the target user account using tools like Hashcat or John the Ripper.
The attacker uses the compromised credentials to gain unauthorized access to resources or perform lateral movement within the network.

Impact

Successful Kerberoasting attacks can compromise user account credentials, potentially leading to unauthorized access to sensitive resources and lateral movement within the network. If privileged accounts are compromised, attackers can gain control over critical systems and data, leading to data breaches, system disruptions, and financial losses. The number of victims depends on the permissions of the compromised account and the scope of the attacker’s access.

Recommendation

Enable and monitor “Audit Directory Service Changes” in Windows Security Event Logs to generate the events required for the detection rule (reference: https://ela.st/audit-directory-service-changes).
Deploy the “User account exposed to Kerberoasting” Sigma rule to your SIEM and tune it based on your environment.
Investigate any alerts generated by the Sigma rule, focusing on identifying the user account that performed the SPN modification and whether the modification was legitimate (reference: Sigma rule).
Implement Group Managed Service Accounts (gMSA) for services running under user accounts to ensure strong and automatically rotated passwords (reference: https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview).